Security

browser name extraction from user agent

super_edition
Path Finder

Hello Everyone,

I am trying to extract the unique browser name along with its count from the list of user agents(attached file) which is printed in user_agent field of splunk logs.

 

index=my_index "master" user-agent!="-" user-agent!="DIAGNOSTICS"
| eval browser=case(
searchmatch("*OPR*"),"Opera",
searchmatch("*Edg*"),"Edge",
searchmatch("*Chrome*Mobile*Safari*"),"Chrome",
searchmatch("*firefox*"),"Firefox",
searchmatch("*CriOS*safari"),"Safari")
| stats count as page_hit by browser

 

I am sure the result count is incorrect as I am not covering all the combination of browser string from the attached list.

Appreciate if someone can help me on this.

Many Thanks

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Do something like this to find out which events aren't being counted and adjust your matches accordingly

| eval browser=case(
searchmatch("*OPR*"),"Opera",
searchmatch("*Edg*"),"Edge",
searchmatch("*Chrome*Mobile*Safari*"),"Chrome",
searchmatch("*firefox*"),"Firefox",
searchmatch("*CriOS*safari"),"Safari")
| where isnull(browser)

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

There is an awful lot of different UAs and they can introduce themselves in many various ways. It's not standardized in any way. So browser detection is more an art than strict science. And it's even before we take into account that people can spoof their UA strings or even set it to any arbitrary value.

There are sites gathering known UA strings though. Like https://explore.whatismybrowser.com/useragents/parse/?analyse-my-user-agent=yes#parse-useragent

BTW, your search is very ineffective.

0 Karma

super_edition
Path Finder

Thanks @PickleRick  for your response.

I am looking to get the count of browsers which are commonly used like chrome, firefox, safari, edge and opera

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do something like this to find out which events aren't being counted and adjust your matches accordingly

| eval browser=case(
searchmatch("*OPR*"),"Opera",
searchmatch("*Edg*"),"Edge",
searchmatch("*Chrome*Mobile*Safari*"),"Chrome",
searchmatch("*firefox*"),"Firefox",
searchmatch("*CriOS*safari"),"Safari")
| where isnull(browser)
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...